Vulnerability in Mybb

CVE-2010-4626

The my_rand function in functions.php in MyBB (aka MyBulletinBoard) before 1.4.12 does not properly use the PHP mt_rand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force attack.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.022 (80.3th percentile) — read the EPSS interpretation.

Affected products

  • Mybb — versions 1.1.1, 1.00, 1.1.7
  • N/a — versions n/a

Weakness classification (CWE)

References